CVE-2022-48926

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-48926
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-48926.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-48926
Downstream
Related
Published
2024-08-22T03:31:18.572Z
Modified
2026-03-20T12:22:00.887002Z
Summary
usb: gadget: rndis: add spinlock for rndis response list
Details

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: rndis: add spinlock for rndis response list

There's no lock for rndis response list. It could cause list corruption if there're two different listadd at the same time like below. It's better to add in rndisaddresponse / rndisfreeresponse / rndisgetnextresponse to prevent any race condition on response list.

[ 361.894299] [1: irq/191-dwc3:16979] list_add corruption. next->prev should be prev (ffffff80651764d0), but was ffffff883dc36f80. (next=ffffff80651764d0).

[ 361.904380] [1: irq/191-dwc3:16979] Call trace: [ 361.904391] [1: irq/191-dwc3:16979] __listaddvalid+0x74/0x90 [ 361.904401] [1: irq/191-dwc3:16979] rndismsgparser+0x168/0x8c0 [ 361.904409] [1: irq/191-dwc3:16979] rndiscommandcomplete+0x24/0x84 [ 361.904417] [1: irq/191-dwc3:16979] usbgadgetgivebackrequest+0x20/0xe4 [ 361.904426] [1: irq/191-dwc3:16979] dwc3gadgetgiveback+0x44/0x60 [ 361.904434] [1: irq/191-dwc3:16979] dwc3ep0completedata+0x1e8/0x3a0 [ 361.904442] [1: irq/191-dwc3:16979] dwc3ep0interrupt+0x29c/0x3dc [ 361.904450] [1: irq/191-dwc3:16979] dwc3processevententry+0x78/0x6cc [ 361.904457] [1: irq/191-dwc3:16979] dwc3processeventbuf+0xa0/0x1ec [ 361.904465] [1: irq/191-dwc3:16979] dwc3threadinterrupt+0x34/0x5c

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48926.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
f6281af9d62e128aa6efad29cf7265062af114f2
Fixed
9f5d8ba538ef81cd86ea587ca3f8c77e26bea405
Fixed
669c2b178956718407af5631ccbc61c24413f038
Fixed
9f688aadede6b862a0a898792b1a35421c93636f
Fixed
9ab652d41deab49848673c3dadb57ad338485376
Fixed
4ce247af3f30078d5b97554f1ae6200a0222c15a
Fixed
da514063440b53a27309a4528b726f92c3cfe56f
Fixed
33222d1571d7ce8c1c75f6b488f38968fa93d2d9
Fixed
aaaba1c86d04dac8e49bf508b492f81506257da3

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-48926.json"